# -*- coding: utf-8 -*-

#funziona, con indirizzi IP, domini e altro (anche reverse lookup, dovrebbe essere il nome dell'host trovato facendo il reverse
#dns lookup dell'indirizzo ip) e se ritorna qualche stringa allora il dominio o l'ip sottoposto è un malware

import urllib
import urllib2
import sys
import re
import string

myParameters = { "search" : "%s" % (sys.argv[1],), "colsearch" : "All", "quantity" : "All"  }

myURL = "http://www.malwaredomainlist.com/mdl.php?%s" % (urllib.urlencode(myParameters),)


data = urllib2.urlopen(myURL).read()
#print data
data = re.sub( r'<[^>]*>', ' ', data ).strip()


data = data.replace("Malware Domain List","")
data = data.replace("Homepage   |   Forums   |   Recent Updates   |   RSS update feed   |   Contact us  ","")
data = data.replace("WARNING: All domains on this website should be considered dangerous. If you do  ","")
data = data.replace("not know what you are doing here, it is recommended you leave right away. This  ","")
data = data.replace("website is a resource for security professionals and enthusiasts.","") 
data = data.replace("&dArr;","")
data = data.replace("&uArr;","")
data = data.replace("Date (UTC)    Domain    IP    Reverse Lookup    Description    Registrant    ASN","")
data = data.replace("You can find an overview of downloadable lists  here","")
data = data.replace("copyright &copy; 2010  www.malwaredomainlist.com","")
data = data.replace("Include inactive sites","")
data = data.replace("   Page  0","")
data = data.lstrip()
data = data.rstrip()
data = data.replace("  ","----")

lista = string.split(data,"\n")
cont = 0
for elem in lista:
    #print cont, elem #stampa di test
    if cont >= 34:
        #print cont, elem #stampa di test
        lista_b = string.split(elem,"----")
        cont_b = 0
        stpstr = ""
        for elem_b in lista_b:
            if cont_b == 5 or cont_b == 1 or cont_b == 3:
                elem_b = elem_b.lstrip()
                #print elem_b #stampa di test
                print sys.argv[1], elem_b.replace("-","")
            cont_b += 1
    cont += 1


#http://www.malwaredomainlist.com/mdl.php?search=18dd.net&colsearch=All&quantity=50
